CsvReadLengthSplitsKnownRecord

warning native on by default

Group: Probable bugs

Identify fgetcsv whose positive integer length is less than a fully known next physical record and splits outside a quoted field. Require local data:// source provenance and full dialect understanding; unknown files exclude.

Detection

• Report fgetcsv whose positive integer length is less than a fully known next physical record and splits outside a quoted field. Require local data:// source provenance and full dialect understanding; unknown files exclude.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values or escaped aliases invalidate proof. When the proof is inconclusive, nothing is reported.
• The handle must be a plain local variable, and that variable must not be mentioned anywhere between the fopen call and the fgetcsv call: no read, write, seek, copy, user call or reassignment, whether or not it is conditional. A variable whose name is computed at run time ($$name) in that stretch counts as a mention. Only then is the record at the stream position the one written in the source.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• Any use of the handle before the read, for example stream_get_line($h, 6), stream_copy_to_stream($h, $out) or consume($h): the position is no longer provably at the start of the known record.
• Both @custos-ignore CsvReadLengthSplitsKnownRecord and @noinspection CsvReadLengthSplitsKnownRecord suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "CsvReadLengthSplitsKnownRecord": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CsvReadLengthSplitsKnownRecord